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IN THE SPECIFICATION 

On page 3, line 5, replace the entire paragraph with the paragraph below, which 
shows the changes made. 

5 1 . The home network if it is its-available (based on MCC and MNC from 

IMSI); 

On page 4, lines 3-12, replace the entire paragraph with the paragraph below, 
1 0 which shows the changes made. 

Some operators also own networks in various countries. These operators would 
like to make sure their out-roamers stay within the group properties, or stay on preferred 
networks, in order to gain the best service experience even when roaming. They will also 

15 be able to offer geography based price plans (for example, a single rate all across Western 
Europe or South East Asia) to users who have subscribed to such plans. In addition, as 
new technologies keep rolling out, operators t hey can control the rollout schedule across 
their own properties and also make sure interoperability issues are taken care of. 
Keeping roaming subscribers on preferred networks gives the best service experience to 

20 the subscriber. However, current methods of controlling which network a subscriber 
registers on when roaming have disadvantages. 

On page 7, lines 1-12, replace the entire paragraph with the paragraph below, 
25 which shows the changes made. 

Registration rejection methods include the following components: detecting the 
network the roamer is currently on; the TR application logic deciding whether the 
registration process should be allowed to succeed or should be rejected; if the network is 
30 to be rejected, various approaches are taken to reject the Update Location with various 
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error codes or to send a subscriber profile with information that makes the handset search 
for a new network; if a preferred network is not found, the TR application logic can 
decide that the user should be provided service on any available network, and hence 
registrations on non-preferred networks are also allowed to go through; a mechanism to 
5 initiate Update Location on demand is also provided, and this can be used to make the 
handset trigger an Update Location periodically; in some embodiments, it is determined 
whether the handset is in manual or automatic network selection mode; and it is also 
determined whether the handset is in the midst of a voice or GPRS/MMS session. 



10 

On page 7, lines 13-16, replace the entire paragraph with the paragraph below, 
which shows the changes made. 

Both the OTA approaches and the registration rejection approaches involve first 
15 detecting that the subscriber is roaming in another network. The two types of approaches 
approach e d also share various databases (to be described below) of information that are i s 
be-used to make traffic redirection decisions. 

20 On page 7, lines 17-25, replace the entire paragraph with the paragraph below, 

which shows the changes made. 

Figure 1 is a block diagram of one embodiment of a traffic redirection system 
100. The system 100 includes network operator backend processes (or "backend") 101, 

25 external systems 126, and traffic redirection network (TR) element 102. These elements 
are used by the network operator to provide wireless services to subscribers, such as 
cellular phone users. Subscribers or users buy services from the operator, including voice 
and data services that the user can access with a phone, a PDA, a PC, or any device (not 
shown in this figure) that can communicate on a wireless network. The user device is 

30 generically referred to as a mobile station in the wireless network. For convenience 
herein, the mobile station will usually be referred to as a handset. 
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On page 8, lines 5-6, replace the entire paragraph with the paragraph below, 
which shows the changes made. 

5 

The network operator backend 101 further includes an integration interface 124 
for facilitating communication with other systems. 

10 On page 10, lines 12-18, replace the entire paragraph with the paragraph below, 

which shows the changes made. 

Another alternative is configuring the operator GMSC/STP 304 to send all the 
E.214 messages to the HLR 302. However, in response to the te4he-Insert Subscriber 
1 5 Data message, if the Called Party Address is outside the operator's numbering plan and 
the Called SSN is a VLR 3 1 2 SSN (SSN=7), the messages are routed via the TR network 
element 102. This achieves the same result as the second alternative listed above but 
limits the number of messages that go via the TR network element 102 since only 
messages meant for external networks need to be handled. 

20 

On page 11, lines 2-9, replace the entire paragraph with the paragraph below, 
which shows the changes made. 

25 The network operator may chose to use various data elements in order to 

selectively redirect registration traffic. For example, pre-paid users may need to be 
redirected to a specific network while post-paid users are be redirected to another 
preferred network in the same country and coverage area. Even within these segments, 
the operator may have business rules to determine if the roamer is a GPRS/MMS 

30 subscriber or just a voice call user. Based on such service profile information, further 
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preference for networks can be established. Some of the database entities that are 
contemplated for embodiments envisaged by this pat e nt application are listed below. 

5 On page 1 1 , lines 28-31, replace the entire paragraph with the paragraph below, 

which shows the changes made. 

A Roaming Partners Tariff database includes tariff information and also typically 
contains typically also contain information regarding whether the roaming partner is part 
10 of a global or geographical tariff plan, whether charges are incurred per minute, or per 
second, or per six seconds, whether there is a minimum charge, etc. 

On page 12, lines 23-26, replace the entire paragraph with the paragraph below, 
1 5 which shows the changes made. 

Figure 5 is a diagram that helps illustrates embodiments of OTA traffic 
redirection. In Figure 5, the subscriber 202 is away from the home network, HPLMN 
212. Several networks are available for the subscriber 202 to roam on, including 
20 VPLMN 504, VPLMN 506, and VPLMN 508. 

On page 13, lines 18-19, replace the entire paragraph with the paragraph below, 
which shows the changes made. 

25 

Location Status - contains the current service state of the Mobile Station; 
Location Status can r -Gan-have values including Normal Service, Limited Service or No 
Service; 

30 
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On page 14, lines 3-4, replace the entire paragraph with the paragraph below, 
which shows the changes made. 

Figure 6 is a flow diagram of an embodiment of OTA traffic redirection, which 
5 will now be described with reference to Figures 5 and 6. Figurc 5 and 6, 

On page 16, lines 1-11, replace the entire paragraph with the paragraph below, 
which shows the changes made. 

10 

Redirection includes using the OTA server 112 is-to update certain SIM card files. 
As shown at 624, the SIM files are updated to reduce an HPLMN search timer period in 
EFhplmn from a default value to a value "01" as specified in ETSI GSM 11.11. This 
specifies that the mobile station will search for the HPMN after 6 minutes. If the 

1 5 redirection attempt is not successful (within next 6 + delta minutes), redirection will be 
re-attempted for a configurable number of times. If the attempt is still not successful or if 
the mobile station switched to the preferred network, the search period specified in 
EFhplmn will be restored to the default value at the discretion of the HPMN. This search 
time reduction may be required on some handsets to trigger a search for the HPLMN and 

20 in the process force an Update Location procedure as defined in ETSI GSM 2.1 1, 4.08, 
3.22 and3GTS 23.122. 

On page 18, lines 25-27, replace the entire paragraph with the paragraph below, 
25 which shows the changes made. 

Each of the processes described above can be performed using passive monitoring 
or by being in the signaling path (active monitoring). The TR node 102b uses a valid 
Global Title and Point Code to inject these messages into the SS7 network 306. 

30 
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On page 1 8, line 28-page 19, line 6, replace the entire paragraph with the 
paragraph below, which shows the changes made. 

The handset 204 tries the Update Location on the same network a few more times. 
5 This attempt count is equal to the value of the ATTEMPT COUNTER (recommended as 
4 in GSM specifications). If there are as many consecutive failures, the handset 204 
searches for a new PLMN. In effect, it goes to the box marked as TR1 in Figure 7 
(Automatic network selection mode) or the box marked as TR2 in Figure 8 (Manual 
network selection mode). Figures 7 and 8 are diagrams showing an and automatic 
10 network selection process and a manual network selection process, respectively , per- per 
the specification 3G TS 23.122 Version 3.1.0 Release 199 (ETSI TS 123 122 V3.1.0 
2000-01). As referred to herein, Figures 7 and 8 show how various embodiments 
interact with the specified processes. 

15 

On page 19, lines 12-17, replace the entire paragraph with the paragraph below, 
which shows the changes made. 

The TR application 102c checks its database information and decides if a traffic 
20 redirection has to be attempted. For example, if the roamer has registered on a non- 
preferred VPMN, the traffic redirection application may decide to perform some actions. 
Other, more specific logic can also be programmed to identify a candidate for traffic 
redirection. For example, preferred networks for pre-paid and post-paid users, or for 
GPRS and non-GPRS users may each differently influence b o different influencing 
25 whether to redirect. 

On page 19, lines 18-26, replace the entire paragraph with the paragraph below, 
which shows the changes made. 

30 
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The traffic redirection application rejects the "first round" of Location Updates 
and thereby forces feree the handset to search for the next available PLMN (in automatic 
roaming network selection mode) or try the same PLMN after a brief delay (in manual 
roaming network selection mode, or if only one network is available in automatic 
5 roaming mode). The "first round" of Update Location is "rejected" by jamming the 
transaction. In one embodiment, jamming the transaction involves sending a spurious 
MAP End Update Location message with a configurable user error. In one embodiment, 
the user error is one of System Failure (local value 34), Data Missing (local value 35) or 
Unexpected Data Value (local value 36). 

10 

On page 19, line 27-page 20, line 5, replace the entire paragraph with the 
paragraph below, which shows the changes made. 

15 Other possible values include Unknown Subscriber (local value 1), and Roaming 

Not Allowed (local value 8). These values, however, can cause various significant 
events. For example, Unknown subscriber translates to "IMSI not known in HLR" on the 
radio interface and this marks the SIM as an invalid SIM. The handset stops further 
PLMN search unless the SIM is removed and reinserted or the handset is powered off and 

20 on. "Roaming Not Allowed" puts the PLMN in the Forbidden PLMN file (EFfplmn) in 
non- volatile memory on the SIM card and the network cannot be selected unless removed 
by an OTA operation, STK application, or manual network selection. This value is 
probably not useful unless the partner network in VPMN country has national coverage 
or there is a roaming relationship with at least at l e ast t hree operators in the visited 

25 country. 

On page 28, lines 1-17, replace the entire paragraph with the paragraph below, 
which shows the changes made. 

30 
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In one embodiment the mechanism of doing this includes selective redirection. 
The TR network entity stays in the SS7 signaling path 1114 and manipulates manipulat e 
the Update Location transaction. Again with reference to Figure 11, the mobile 
subscriber 1 102 is roaming in VPLMN 1 108, and initiates the registration process on the 
5 network. The Update Location message is routed from the VPLMN 1108 to HPLMN 
1112 where the message is routed via the TR network element 102 to the HLR 1302. The 
HLR 1302 sends the subscriber profile to the VLR 1312 using the Insert Subscriber Data 
message. This message is routed via the TR network element 102. TR network element 
102 modifies the Subscriber Status in the message to "Operator Determined Barring". 

10 This allows the mobile station 1 104 to register, but does not allow the subscriber 1 102 to 
make or receive any calls. Immediately afterwards the TR network element 1 02 sends a 
MAP Provide Subscriber Information message to the VLR 1312. The VLR 1312 returns 
the cell-id of the mobile station 1104 gathered during the Update Location Area 
transaction. Based on this cell-id information, the HPLMN 1112 may decide if it wants 

15 the roamer to register on this network (for example, when HPLMN 1112 does 1112do e s 
not offer service in that specific region) or search for another network (for example, if the 
roamer is in or close to an area where the HPLMN 1112 also offers service). 
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